Description

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:18:28.793Z",
  "pubdate": "2026-08-28T20:18:28.793Z",
  "executiveSummary": "Yamcs is affected by a path traversal vulnerability residing within the StaticFileHandler component, which permits unauthorized read access to the underlying host filesystem.\nThe vulnerability arises from insufficient validation of user-supplied input when resolving file paths relative to the configured static roots.\nUnauthenticated remote attackers can exploit this flaw by submitting crafted requests containing path traversal sequences, such as dot-dot-slash (../) patterns.\nSuccessful exploitation allows the retrieval of arbitrary files from the server, potentially exposing sensitive operating-system configurations, credentials, application source code, or internal mission control data.\nThe risk is severe as it bypasses intended directory restrictions without requiring authentication or elevated privileges.\nThis vulnerability is addressed in Yamcs versions 5.11.13 and 5.12.0.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of path sanitization within the StaticFileHandler.locateFile method in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java.\nThe application fails to apply Path.normalize and Path.toAbsolutePath operations to the requested URI path before concatenating it with the configured staticRoot directory. These security controls are essential to resolve relative path segments and ensure the final target resides within the designated, safe directory tree.\nAn attacker can exploit this by injecting traversal sequences into the URL path. When the application processes a request, it improperly joins the unvalidated input with the web root path. If the input contains sequences like '../../', the resulting filesystem path will escape the intended directory structure.\nThe attack flow proceeds as follows: First, the attacker identifies the web service endpoint served by the StaticFileHandler. Second, the attacker sends an HTTP GET request with a manipulated path, such as /yamcs/static/../../../../etc/passwd. Third, because the application lacks normalization checks, the logic treats the traversal segments as valid filesystem instructions, navigating upward through the directory hierarchy.\nThe impact is significant: the server reads the target file and returns its contents in the HTTP response body. This enables the disclosure of sensitive files such as /etc/passwd, shadow files, environment variables, configuration files containing API keys or database credentials, and application-specific secrets.\nThe vulnerability is present in versions prior to 5.11.13. Versions 5.11.13 and 5.12.0 include the necessary code changes to prevent such path escapes. The flaw is exploitable over the network by any unauthenticated remote user with access to the Yamcs HTTP interface.\nBecause the application logic blindly trusts the incoming path, it effectively elevates the attacker's file read capabilities to the level of the system user account under which the Yamcs process is executing, bypassing all logical segmentation established by the static root configuration."
}